@agentvalet/mcp-server 1.6.1 → 1.10.0

package/README.md

@@ -1,70 +1,85 @@
-# @agentvalet/mcp-server
-
-MCP server that lets AI agents (Claude Code, Cursor, Codex CLI, etc.) call approved external platforms through the AgentValet proxy.
-
-## Quick start
-
-```bash
-npx @agentvalet/register   # registers this machine as an agent, writes config
-```
-
-The CLI writes env vars and optionally updates `.mcp.json` or `.cursor/mcp.json` automatically.
-
-## Manual configuration
-
-Add to your `.mcp.json` or equivalent:
-
-```json
-{
-  "mcpServers": {
-    "agentvalet": {
-      "command": "npx",
-      "args": ["-y", "@agentvalet/mcp-server"],
-      "env": {
-        "AGENT_ID": "agt_...",
-        "OWNER_ID": "...",
-        "PROXY_URL": "https://api.agentvalet.ai",
-        "AGENT_PRIVATE_KEY_PATH": "/path/to/agent.key"
-      }
-    }
-  }
-}
-```
-
-## Environment variables
-
-| Variable | Required | Description |
-|----------|----------|-------------|
-| `AGENT_ID` | Yes | Agent ID from registration |
-| `OWNER_ID` | Yes | Owner ID from registration |
-| `PROXY_URL` | Yes | AgentValet proxy URL |
-| `AGENT_PRIVATE_KEY_PATH` | One of three | Path to PEM private key file |
-| `AGENT_PRIVATE_KEY` | One of three | Raw PEM or `\n`-escaped single-line PEM |
-| `AGENT_PRIVATE_KEY_B64` | One of three | Base64-encoded PEM |
-| `MCP_TRANSPORT` | No | Set to `http` to use HTTP transport instead of STDIO |
-| `MCP_PORT` | No | Port for HTTP transport (default: `3100`) |
-
-## Tools
-
-| Tool | Auth | Description |
-|------|------|-------------|
-| `list_platforms` | JWT | List platforms and scopes this agent has access to |
-| `use_platform` | JWT | Call an external platform API through the proxy (blocks for owner approval when required) |
-| `authzen_evaluate` | JWT | Pre-check whether this agent has access to a platform scope, without making the call |
-| `list_my_pending_actions` | JWT | List this agent's pending approvals and actions completed in the last 24h |
-| `request_platform_access` | JWT | Ask an org admin to grant access to a platform the agent is blocked from |
-| `report_self_diagnostic` | JWT | Lodge a self-report (error/warning/info) with the owner |
-| `agent_register` | None | Self-register a new agent with an owner |
-| `agent_status` | None | Poll registration approval status |
-
-## Transports
-
-**STDIO (default)** — compatible with all MCP hosts (Claude Code, Cursor, Codex CLI).
-
-**HTTP** — set `MCP_TRANSPORT=http` and optionally `MCP_PORT=3100`. Uses `StreamableHTTPServerTransport`.
-
-## Architecture
-
-Each tool call signs a short-lived RS256 JWT (`exp: 60s`) using the agent's private key. The JWT is verified by the AgentValet proxy, which checks permissions and forwards the request to the target platform using stored credentials.
-
-The agent never sees platform credentials. The proxy decrypts them in-memory at call time and discards them after the upstream request completes.
+# @agentvalet/mcp-server
+
+MCP server that lets AI agents (Claude Code, Cursor, Codex CLI, etc.) call approved external platforms through the AgentValet proxy.
+
+## Quick start
+
+```bash
+npx @agentvalet/register   # registers this machine as an agent, writes config
+```
+
+The CLI writes env vars and optionally updates `.mcp.json` or `.cursor/mcp.json` automatically.
+
+## Manual configuration
+
+Add to your `.mcp.json` or equivalent:
+
+```json
+{
+  "mcpServers": {
+    "agentvalet": {
+      "command": "npx",
+      "args": ["-y", "@agentvalet/mcp-server"],
+      "env": {
+        "AGENT_ID": "agt_...",
+        "OWNER_ID": "...",
+        "PROXY_URL": "https://api.agentvalet.ai",
+        "AGENT_PRIVATE_KEY_PATH": "/path/to/agent.key"
+      }
+    }
+  }
+}
+```
+
+## Environment variables
+
+| Variable | Required | Description |
+|----------|----------|-------------|
+| `AGENT_ID` | Yes | Agent ID from registration |
+| `OWNER_ID` | Yes | Owner ID from registration |
+| `PROXY_URL` | Yes | AgentValet proxy URL |
+| `AGENT_PRIVATE_KEY_PATH` | One of three | Path to PEM private key file |
+| `AGENT_PRIVATE_KEY` | One of three | Raw PEM or `\n`-escaped single-line PEM |
+| `AGENT_PRIVATE_KEY_B64` | One of three | Base64-encoded PEM |
+| `MCP_TRANSPORT` | No | Set to `http` to use HTTP transport instead of STDIO |
+| `MCP_PORT` | No | Port for HTTP transport (default: `3100`) |
+
+## Tools
+
+| Tool | Auth | Description |
+|------|------|-------------|
+| `list_platforms` | JWT | List platforms and scopes this agent has access to |
+| `read_platform` | JWT | Read from an external platform API through the proxy (always GET) |
+| `write_platform` | JWT | Create or update through the proxy (POST/PUT/PATCH; blocks for owner approval when required) |
+| `delete_platform` | JWT | Delete through the proxy (always DELETE; blocks for owner approval when required) |
+| `use_platform` | JWT | Deprecated catch-all. Use the three tools above; removed in the next major. |
+| `authzen_evaluate` | JWT | Pre-check whether this agent has access to a platform scope, without making the call |
+| `list_my_pending_actions` | JWT | List this agent's pending approvals and actions completed in the last 24h |
+| `request_platform_access` | JWT | Ask an org admin to grant access to a platform the agent is blocked from |
+| `report_self_diagnostic` | JWT | Lodge a self-report (error/warning/info) with the owner |
+| `agent_register` | None | Self-register a new agent with an owner |
+| `agent_status` | None | Poll registration approval status |
+| `issue_child_agent` | JWT | Mint a short-lived child identity for a subagent: its own agent id, an attenuated scope slice (child ⊆ parent), its own audit trail, individually revocable. Returns a bearer token for the subagent's `Authorization` header. |
+
+## Session attribution
+
+Every assertion this server signs carries a stable per-process `session_id`
+claim, which the proxy stamps on each audit row. It distinguishes *runs* of
+the server, not subagents: hosts that share one server process (for example
+Claude Code Task-tool subagents) share the id. HTTP callers without this
+server can supply the same discriminator via an `X-AV-Session` header
+(`[A-Za-z0-9._:-]{1,128}`). Both are caller-asserted forensics — the proxy
+never makes an authorization decision on them. For verified per-subagent
+identity, mint a child with `issue_child_agent` instead.
+
+## Transports
+
+**STDIO (default)** — compatible with all MCP hosts (Claude Code, Cursor, Codex CLI).
+
+**HTTP** — set `MCP_TRANSPORT=http` and optionally `MCP_PORT=3100`. Uses `StreamableHTTPServerTransport`.
+
+## Architecture
+
+Each tool call signs a short-lived RS256 JWT (`exp: 60s`) using the agent's private key. The JWT is verified by the AgentValet proxy, which checks permissions and forwards the request to the target platform using stored credentials.
+
+The agent never sees platform credentials. The proxy decrypts them in-memory at call time and discards them after the upstream request completes.

package/dist/auth.js

@@ -9,7 +9,7 @@ import { fetchWithTimeout } from "./net.js";
 export async function signJWT(ctx) {
     if (!ctx.privateKey)
         throw new Error("Private key not loaded");
-    return new SignJWT({ agent_id: ctx.AGENT_ID, owner_id: ctx.OWNER_ID })
+    return new SignJWT({ agent_id: ctx.AGENT_ID, owner_id: ctx.OWNER_ID, session_id: ctx.SESSION_ID })
         .setProtectedHeader({ alg: "RS256" })
         .setIssuedAt()
         .setExpirationTime("60s")

package/dist/index.js

@@ -15,6 +15,7 @@ process.on("unhandledRejection", (err) => {
     process.stderr.write(`[mcp-server] FATAL unhandledRejection: ${err instanceof Error ? err.stack ?? err.message : String(err)}\n`);
     process.exit(1);
 });
+import { randomBytes } from "node:crypto";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
@@ -22,7 +23,7 @@ import { validateConfig } from "./config.js";
 import { renderInstructions } from "./instructions.js";
 import { signJWT } from "./auth.js";
 import { ALLOWED_METHODS, ALL_TOOLS } from "./tools/schemas.js";
-import { handleListPlatforms, handleUsePlatform, handleAgentRegister, handleAgentStatus, handleAuthzenEvaluate, handleListMyPendingActions, handleReportSelfDiagnostic, handleRequestPlatformAccess, } from "./tools/handlers.js";
+import { handleListPlatforms, handleUsePlatform, handleAgentRegister, handleAgentStatus, handleAuthzenEvaluate, handleListMyPendingActions, handleReportSelfDiagnostic, handleRequestPlatformAccess, handleIssueChildAgent, } from "./tools/handlers.js";
 import { errorContent } from "./net.js";
 import { getPermissionsVersion, recordPermissionsVersion, startPermissionsWatcher, } from "./permissions-watcher.js";
 // ---------------------------------------------------------------------------
@@ -47,12 +48,18 @@ const server = new Server({ name: "agentvalet", version: "1.0.0" },
 // permissions-watcher.ts). Declaring the capability is what makes the SDK
 // allow that notification.
 { capabilities: { tools: { listChanged: true } }, instructions: renderInstructions(undefined) });
+// One id per server process. Discriminates runs in audit_log.session_id;
+// forensics only — the proxy never branches enforcement on it. Note: Claude
+// Code Task-tool subagents share the parent process, so this discriminates
+// processes/runs, not subagents.
+const SESSION_ID = "sess_" + randomBytes(8).toString("hex");
 // The config + server bundle threaded into auth + handlers (see context.ts) —
 // keeps those modules free of globals.
 const ctx = {
     AGENT_ID,
     OWNER_ID,
     PROXY_URL,
+    SESSION_ID,
     AGENT_PRIVATE_KEY_RAW,
     privateKey,
     server,
@@ -102,7 +109,8 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
                 ...tool,
                 description: `${tool.description}\nCurrent permissions version: ${version}. If you are holding a ` +
                     `list_platforms result from a different version, it is STALE — call list_platforms ` +
-                    `again before relying on its scopes or requireApproval flags.`,
+                    `again before relying on its scopes, requireApproval flags, or approvalScopes ` +
+                    `(the scopes whose calls need human approval under the owner's policy).`,
             }
             : tool),
     };
@@ -146,6 +154,39 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             ...(typeof args.reason === "string" ? { reason: args.reason } : {}),
         }, progressToken);
     }
+    // The split tools. handleUsePlatform already takes the method as a parameter,
+    // so the method is supplied HERE rather than by the model — which is what
+    // makes read_platform genuinely read-only.
+    if (name === "read_platform" || name === "write_platform" || name === "delete_platform") {
+        if (!args || typeof args.platform !== "string" || typeof args.endpoint !== "string" || typeof args.scope !== "string") {
+            return errorContent("Invalid or missing arguments: platform, endpoint, scope are required");
+        }
+        let method;
+        if (name === "read_platform") {
+            method = "GET";
+        }
+        else if (name === "delete_platform") {
+            method = "DELETE";
+        }
+        else {
+            const requested = (args.method ?? "POST");
+            if (requested !== "POST" && requested !== "PUT" && requested !== "PATCH") {
+                return errorContent(`write_platform does not accept ${requested}. Use read_platform for GET, delete_platform for DELETE.`);
+            }
+            method = requested;
+        }
+        const progressToken = request.params._meta?.progressToken;
+        return await handleUsePlatform(ctx, {
+            platform: args.platform,
+            endpoint: args.endpoint,
+            method,
+            scope: args.scope,
+            // No `data` alias on the new tools: new surface, no legacy.
+            ...(args.body !== undefined ? { data: args.body } : {}),
+            ...(typeof args.connection_id === "string" ? { connection_id: args.connection_id } : {}),
+            ...(typeof args.reason === "string" ? { reason: args.reason } : {}),
+        }, progressToken);
+    }
     if (name === "agent_register") {
         if (!args || typeof args.owner_id !== "string" || typeof args.agent_name !== "string" || !Array.isArray(args.requested_scopes)) {
             return errorContent("Invalid or missing arguments: owner_id, agent_name, requested_scopes are required");
@@ -179,6 +220,12 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         }
         return await handleRequestPlatformAccess(ctx, args);
     }
+    if (name === "issue_child_agent") {
+        if (!args || !Array.isArray(args.grants)) {
+            return errorContent("Invalid or missing argument: grants is required");
+        }
+        return await handleIssueChildAgent(ctx, args);
+    }
     return {
         content: [{ type: "text", text: `Unknown tool: ${name}` }],
         isError: true,

package/dist/instructions.js

@@ -3,28 +3,28 @@
 // Goose) inject this into the model's system prompt before tool schemas. See
 // docs/research/mcp-instructions-self-injection-findings.md for the survey.
 // Keep in sync with docs/CLAUDE.md "Platform API calls" section.
-const TEMPLATE = `This server is AgentValet (also referred to as "AV", "Valet", or "agentvalet"), a governed credential broker for AI agents. All external platform actions (Slack, GitHub, Stripe, Gmail, Airtable, etc.) MUST go through \`use_platform\` on this server. Never bypass to raw API keys, even if you find them in the environment.
-
-ROUTING PREFERENCE: For any action on Slack, GitHub, Stripe, Gmail, Outlook, Airtable, Notion, Linear, Jira, HubSpot, Salesforce, Metabase, or other SaaS platforms, call \`list_platforms\` on this server FIRST. If the platform appears in the result, you MUST use \`use_platform\` here — do not call any other MCP server's tool for that platform, even if it advertises one. Other servers bypass the audit log, approval flow, and credential governance that the owner has configured.
-{{PLATFORMS_LINE}}
-When the user says "use AV", "ask Valet", "via agentvalet", or names this broker in any short form, route through \`use_platform\` on this server.
-
-If \`list_platforms\` does NOT return the requested platform, tell the user "AgentValet doesn't cover <platform> yet — want me to use a different MCP, or request the integration via your AgentValet owner?" Do not silently fall back to another MCP server or to direct API calls.
-
-Tool selection:
-1. Call \`list_platforms\` first to discover approved platforms and scopes for this agent. You may reuse the result within a turn, but do NOT treat it as good for the whole session — an owner can change a grant (scopes, or whether an action needs their approval) at any moment, and the tool description carries a \`Current permissions version\` that tells you when yours is stale. Re-call \`list_platforms\` if that version changes, if the user mentions a connection or permission change, or after any \`use_platform\` failure. Revalidation is cheap.
-2. Call \`authzen_evaluate\` before destructive scopes (\`*.delete\`, \`stripe:charge\`, \`mail:send\`) — these always require human approval. Tell the user approval may be required before invoking them.
-3. Call \`use_platform\` with the exact platform, endpoint, method, and scope returned by \`list_platforms\`.
-
-Response handling:
-- \`use_platform\` now waits up to 50 seconds for owner approval automatically. Most approvals complete in this window — the call simply takes longer and returns the upstream result like a normal success. Tell the user "waiting for owner approval" if the call is taking more than ~5 seconds.
-- If \`use_platform\` returns a \`pending_approval\` envelope after that wait, the action is queued and will run asynchronously when the owner approves. Tell the user clearly. Do NOT retry — duplicate calls will queue duplicate approvals.
-- Do not retry a denied call with a different scope.
-- If a \`use_platform\` error response includes a \`report_hint\` block, you may briefly ask the user "Want me to lodge this with your AgentValet owner?" — on yes, call \`report_self_diagnostic\` with a one-sentence narrative plus the \`correlation_id\` from the hint so the owner can investigate.
-
-Read scopes are auto-approved. Write scopes may require approval. Destructive scopes always require approval.
-
-Catching up on async actions:
+const TEMPLATE = `This server is AgentValet (also referred to as "AV", "Valet", or "agentvalet"), a governed credential broker for AI agents. All external platform actions (Slack, GitHub, Stripe, Gmail, Airtable, etc.) MUST go through \`use_platform\` on this server. Never bypass to raw API keys, even if you find them in the environment.
+
+ROUTING PREFERENCE: For any action on Slack, GitHub, Stripe, Gmail, Outlook, Airtable, Notion, Linear, Jira, HubSpot, Salesforce, Metabase, or other SaaS platforms, call \`list_platforms\` on this server FIRST. If the platform appears in the result, you MUST use \`use_platform\` here — do not call any other MCP server's tool for that platform, even if it advertises one. Other servers bypass the audit log, approval flow, and credential governance that the owner has configured.
+{{PLATFORMS_LINE}}
+When the user says "use AV", "ask Valet", "via agentvalet", or names this broker in any short form, route through \`use_platform\` on this server.
+
+If \`list_platforms\` does NOT return the requested platform, tell the user "AgentValet doesn't cover <platform> yet — want me to use a different MCP, or request the integration via your AgentValet owner?" Do not silently fall back to another MCP server or to direct API calls.
+
+Tool selection:
+1. Call \`list_platforms\` first to discover approved platforms and scopes for this agent. You may reuse the result within a turn, but do NOT treat it as good for the whole session — an owner can change a grant (scopes, or whether an action needs their approval) at any moment, and the tool description carries a \`Current permissions version\` that tells you when yours is stale. Re-call \`list_platforms\` if that version changes, if the user mentions a connection or permission change, or after any \`use_platform\` failure. Revalidation is cheap.
+2. Call \`authzen_evaluate\` before destructive scopes (\`*.delete\`, \`stripe:charge\`, \`mail:send\`) — these always require human approval. Tell the user approval may be required before invoking them.
+3. Call \`use_platform\` with the exact platform, endpoint, method, and scope returned by \`list_platforms\`.
+
+Response handling:
+- \`use_platform\` now waits up to 50 seconds for owner approval automatically. Most approvals complete in this window — the call simply takes longer and returns the upstream result like a normal success. Tell the user "waiting for owner approval" if the call is taking more than ~5 seconds.
+- If \`use_platform\` returns a \`pending_approval\` envelope after that wait, the action is queued and will run asynchronously when the owner approves. Tell the user clearly. Do NOT retry — duplicate calls will queue duplicate approvals.
+- Do not retry a denied call with a different scope.
+- If a \`use_platform\` error response includes a \`report_hint\` block, you may briefly ask the user "Want me to lodge this with your AgentValet owner?" — on yes, call \`report_self_diagnostic\` with a one-sentence narrative plus the \`correlation_id\` from the hint so the owner can investigate.
+
+Read scopes are auto-approved. Write scopes may require approval. Destructive scopes always require approval.
+
+Catching up on async actions:
 - If the user mentions a previous action ("did the Slack post go through?", "what happened to that earlier request?") OR if the previous \`use_platform\` returned a \`pending_approval\` envelope, call \`list_my_pending_actions\` to surface what's pending and what's recently completed. Tell the user the result naturally — don't dump the JSON.`;
 /**
  * Render the instructions string. If a platform list is provided, the

package/dist/permissions-watcher.js

@@ -9,7 +9,8 @@
 // nothing ever told the agent the spec had moved.
 //
 // GET /v1/agent/permissions returns a deterministic `version` hash over the
-// effective spec (scopes + requireApproval + connections). We poll it with
+// effective spec (scopes + requireApproval + policy-level approvalScopes +
+// connections incl. per-connection requireApproval). We poll it with
 // If-None-Match, so an unchanged spec costs a 304 with no body. When the hash
 // does move we emit notifications/tools/list_changed; the host re-reads
 // tools/list, and because the list_platforms description is stamped with the

package/dist/tools/handlers.js

@@ -347,6 +347,17 @@ export async function handleRequestPlatformAccess(ctx, args) {
         message: "Request submitted and awaiting admin approval. Retry your call later.",
     }));
 }
+export async function handleIssueChildAgent(ctx, args) {
+    const gate = await requireCredentials(ctx);
+    if (gate)
+        return gate;
+    const resp = await fetchWithAuth(ctx, `${ctx.PROXY_URL}/v1/agents/children`, {
+        method: "POST",
+        body: JSON.stringify(args ?? {}),
+    });
+    const json = await resp.json().catch(() => ({ error: `HTTP ${resp.status}` }));
+    return { content: [{ type: "text", text: JSON.stringify(json) }], isError: !resp.ok };
+}
 export async function handleReportSelfDiagnostic(ctx, args) {
     const gate = await requireCredentials(ctx);
     if (gate)

package/dist/tools/schemas.js

@@ -7,7 +7,7 @@
 export const ALLOWED_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
 export const LIST_PLATFORMS_TOOL = {
     name: "list_platforms",
-    description: "list_platforms: List the platforms and permission scopes this agent has access to.\nInput: None.\nReturns: { platforms: [{ platformId, platformName, scopes, requireApproval, connections? }], version: \"<hex>\" }. A platform includes `connections` only when it has 2+ usable accounts; pass the chosen connection_id to use_platform (omit for the default).\nVersion: a deterministic hash over the effective spec — it changes whenever the platform set, the scopes, or the requireApproval flags change. Compare it against the `Current permissions version` stamped on this description: if they differ, your cached result is stale and you must call list_platforms again before trusting it.\nAuth: Bearer JWT.",
+    description: "list_platforms: List the platforms and permission scopes this agent has access to.\nInput: None.\nReturns: { platforms: [{ platformId, platformName, scopes, requireApproval, approvalScopes?, connections? }], version: \"<hex>\" }. A platform includes `connections` only when it has 2+ usable accounts; pass the chosen connection_id to use_platform (omit for the default).\nApproval: a call needs human approval if the platform's requireApproval is true (grant-level: every call prompts), if the chosen connection's requireApproval is true, or if the scope is listed in approvalScopes (policy-level: just those scopes prompt). approvalScopes is omitted when no scope is policy-gated.\nVersion: a deterministic hash over the effective spec — it changes whenever the platform set, the scopes, the approval requirements (grant or policy), or the connections change. Compare it against the `Current permissions version` stamped on this description: if they differ, your cached result is stale and you must call list_platforms again before trusting it.\nAuth: Bearer JWT.",
     inputSchema: { type: "object", properties: {} },
     outputSchema: {
         type: "object",
@@ -21,6 +21,11 @@ export const LIST_PLATFORMS_TOOL = {
                         platformName: { type: "string" },
                         scopes: { type: "array", items: { type: "string" } },
                         requireApproval: { type: "boolean" },
+                        approvalScopes: {
+                            type: "array",
+                            description: "Present only when the owner's policy or an org guardrail gates some scopes on human approval. Subset of `scopes`: calls under these scopes prompt the owner even when requireApproval is false.",
+                            items: { type: "string" },
+                        },
                         connections: {
                             type: "array",
                             description: "Present only when this platform has 2+ usable connections (e.g. two GitHub orgs). Pass the chosen connection_id to use_platform; omit to use the default connection.",
@@ -30,6 +35,7 @@ export const LIST_PLATFORMS_TOOL = {
                                     connection_id: { type: "string" },
                                     label: { type: "string" },
                                     is_default: { type: "boolean" },
+                                    requireApproval: { type: "boolean" },
                                     scopes: { type: "array", items: { type: "string" } },
                                 },
                                 required: ["connection_id", "label"],
@@ -87,6 +93,89 @@ export const USE_PLATFORM_TOOL = {
         required: ["platform", "endpoint", "method", "scope"],
     },
 };
+// --- The read/write/delete split -------------------------------------------
+//
+// Descriptions are copied VERBATIM from apps/proxy/src/mcp/tools.ts so the two
+// servers cannot drift. read_platform and delete_platform declare no `method`
+// property at all: the method is supplied at dispatch, which is what makes the
+// readOnlyHint annotation enforced rather than merely promised.
+export const READ_PLATFORM_TOOL = {
+    name: "read_platform",
+    description: "read_platform: Read data from a platform the owner has connected, through the AgentValet proxy. Calls the platform's own public REST API (for example the GitHub REST API, the Slack Web API, the Stripe API); `endpoint` is a path in that API exactly as its documentation defines it. Always issues GET — use write_platform to create or update, and delete_platform to remove. Input: platform, endpoint, scope, connection_id (optional), reason (optional). Returns: the upstream API response body. Auth: Bearer JWT.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            platform: { type: "string", description: "Platform ID (e.g. github, slack, stripe)" },
+            endpoint: { type: "string", description: "Path in the platform's own API (e.g. /user/repos)" },
+            scope: { type: "string", description: "Permission scope required for this read (e.g. repo:read)" },
+            connection_id: {
+                type: "string",
+                description: "Optional. Target a specific connection when a platform has more than one connected. Omit to use the default.",
+            },
+            reason: {
+                type: "string",
+                description: "Optional but strongly encouraged. One sentence on WHY you are making this call. Shown to the human approver if the call is gated. Max 500 characters; plain text.",
+            },
+        },
+        required: ["platform", "endpoint", "scope"],
+    },
+};
+export const WRITE_PLATFORM_TOOL = {
+    name: "write_platform",
+    description: "write_platform: Create or update data on a platform the owner has connected, through the AgentValet proxy. Calls the platform's own public REST API (for example the GitHub REST API, the Slack Web API, the Stripe API); `endpoint` is a path in that API exactly as its documentation defines it. Accepts POST, PUT or PATCH only — use read_platform for GET and delete_platform for DELETE. May block up to 50s for owner approval, then returns the approved result; otherwise returns a pending_approval envelope. Input: platform, endpoint, scope, method (optional, default POST), body (optional), connection_id (optional), reason (optional). Auth: Bearer JWT.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            platform: { type: "string", description: "Platform ID (e.g. github, slack, stripe)" },
+            endpoint: { type: "string", description: "Path in the platform's own API (e.g. /api/chat.postMessage)" },
+            method: {
+                type: "string",
+                enum: ["POST", "PUT", "PATCH"],
+                default: "POST",
+                description: "POST to create, PUT to replace, PATCH to modify. Defaults to POST.",
+            },
+            scope: { type: "string", description: "Permission scope required for this write (e.g. chat:write)" },
+            body: {
+                type: "object",
+                description: "JSON request body, forwarded verbatim to the upstream API.",
+            },
+            connection_id: {
+                type: "string",
+                description: "Optional. Target a specific connection when a platform has more than one connected. Omit to use the default.",
+            },
+            reason: {
+                type: "string",
+                description: "Optional but strongly encouraged. One sentence on WHY you are making this call. Shown to the human approver if the call is gated. Max 500 characters; plain text.",
+            },
+        },
+        required: ["platform", "endpoint", "scope"],
+    },
+};
+export const DELETE_PLATFORM_TOOL = {
+    name: "delete_platform",
+    description: "delete_platform: Delete data on a platform the owner has connected, through the AgentValet proxy. Calls the platform's own public REST API (for example the GitHub REST API, the Slack Web API, the Stripe API); `endpoint` is a path in that API exactly as its documentation defines it. Always issues DELETE. This removes data and is not reversible by AgentValet. May block up to 50s for owner approval. Input: platform, endpoint, scope, body (optional), connection_id (optional), reason (optional). Auth: Bearer JWT.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            platform: { type: "string", description: "Platform ID (e.g. github, slack, stripe)" },
+            endpoint: { type: "string", description: "Path in the platform's own API (e.g. /repos/owner/name)" },
+            scope: { type: "string", description: "Permission scope required for this delete (e.g. repo:delete)" },
+            body: {
+                type: "object",
+                description: "Optional JSON request body, forwarded verbatim.",
+            },
+            connection_id: {
+                type: "string",
+                description: "Optional. Target a specific connection when a platform has more than one connected. Omit to use the default.",
+            },
+            reason: {
+                type: "string",
+                description: "Optional but strongly encouraged. One sentence on WHY you are deleting this. Shown to the human approver if the call is gated. Max 500 characters; plain text.",
+            },
+        },
+        required: ["platform", "endpoint", "scope"],
+    },
+};
 export const AGENT_REGISTER_TOOL = {
     name: "agent_register",
     description: "agent_register: Self-register this agent with an owner. No auth required.\nInput: owner_id (string), agent_name (string), requested_scopes (array of {platformId, scopes}).\nReturns: registration_token, poll_url, client_id, scope, expires_in.\nAuth: None.",
@@ -286,13 +375,45 @@ export const REQUEST_PLATFORM_ACCESS_TOOL = {
         required: ["status"],
     },
 };
+export const ISSUE_CHILD_AGENT_TOOL = {
+    name: "issue_child_agent",
+    description: "Issue a short-lived child agent identity for a subagent you are about to spawn. The child gets its own agent id, its own attenuated permission slice (child scopes must be a subset of yours), and its own audit trail; it can be revoked alone without touching you or its siblings. Returns a bearer token the subagent must send as its Authorization header. TTL 60-3600s (default 900). Inject ONLY the bearer_token into the subagent's context — never your own credentials.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            name: { type: "string", description: "Optional human-readable name for the child agent (1-200 chars)." },
+            ttl_seconds: {
+                type: "number",
+                description: "Optional lifetime in seconds for the child's bearer token. 60-3600, default 900.",
+            },
+            grants: {
+                type: "array",
+                description: "Array of platform grants to attenuate onto the child. Each scope must be a subset of your own granted scopes.",
+                items: {
+                    type: "object",
+                    properties: {
+                        platform: { type: "string", description: "Platform ID (e.g. github, slack)" },
+                        scopes: { type: "array", items: { type: "string" }, description: "Scopes to grant the child for this platform." },
+                        connection_id: { type: "string", description: "Optional. Target a specific connection when a platform has more than one connected." },
+                    },
+                    required: ["platform", "scopes"],
+                },
+            },
+        },
+        required: ["grants"],
+    },
+};
 export const ALL_TOOLS = [
     LIST_PLATFORMS_TOOL,
     USE_PLATFORM_TOOL,
+    READ_PLATFORM_TOOL,
+    WRITE_PLATFORM_TOOL,
+    DELETE_PLATFORM_TOOL,
     AGENT_REGISTER_TOOL,
     AGENT_STATUS_TOOL,
     AUTHZEN_EVALUATE_TOOL,
     REPORT_SELF_DIAGNOSTIC_TOOL,
     LIST_MY_PENDING_ACTIONS_TOOL,
     REQUEST_PLATFORM_ACCESS_TOOL,
+    ISSUE_CHILD_AGENT_TOOL,
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvalet/mcp-server",
-  "version": "1.6.1",
+  "version": "1.10.0",
   "description": "AgentValet MCP server — lets AI agents call approved platforms via the AgentValet proxy",
   "mcpName": "io.github.agentvalet/mcp-server",
   "type": "module",
@@ -12,6 +12,14 @@
     "dist",
     "README.md"
   ],
+  "scripts": {
+    "dev": "tsx src/index.ts",
+    "build": "tsc",
+    "start": "node dist/index.js",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "node ../../scripts/no-secrets.mjs && npm run build && node ../../scripts/no-workspace-protocol.mjs"
+  },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
     "jose": "^5.10.0"
@@ -37,12 +45,5 @@
     "agentvalet"
   ],
   "license": "MIT",
-  "homepage": "https://github.com/AgentValet/AgentValet#readme",
-  "scripts": {
-    "dev": "tsx src/index.ts",
-    "build": "tsc",
-    "start": "node dist/index.js",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit"
-  }
-}
+  "homepage": "https://github.com/AgentValet/AgentValet#readme"
+}